Cyberstudy
PDF p.144 In progress

Transport Layer Security Tunneling

Open PDF at p.144 18 flashcards

Summary

PDF p.144

Transport Layer Security (TLS) VPNs use digital certificates for secure connections between clients and remote access servers. TLS creates an encrypted tunnel for authentication and communication, supporting both TCP and UDP. The latest secure versions of TLS are 1.3 and 1.2.

In plain words

Supplementary — not from your PDF

A TLS VPN uses a server certificate to prove the gateway's identity (and optionally a client certificate for mutual authentication), then creates an encrypted tunnel. Credentials are sent inside that tunnel, often checked by RADIUS. It can run over TCP (which gets through firewalls easily) or UDP as DTLS (better for voice and video). Use TLS 1.2 or 1.3 only.

Detailed explanation

PDF p.144
  • TLS VPN
    • Digital Certificates: Used for client-server connections.
    • Server Certificate: Identifies the VPN gateway to the client.
    • Mutual Authentication: Optional client certificate for mutual identity verification.
    • Encrypted Tunnel: TLS creates a secure tunnel for submitting authentication credentials.
    • Authentication Processing: Typically handled by a RADIUS server.
    • Communication Tunneling: VPN gateway tunnels all local network communications over the secure socket.
  • Protocol Options
    • TCP or UDP: TLS VPN can use either protocol.
    • UDP (Datagram TLS - DTLS): Chosen for better performance with latency-sensitive traffic (e.g., voice, video).
    • TCP: Easier to use with default firewall policies.
  • TLS Versions
    • Secure Versions: TLS 1.3 and TLS 1.2.
    • Deprecated Versions: Versions earlier than TLS 1.2.

Important terms

taken from the text above
Digital Certificates
Used for client-server connections.
Server Certificate
Identifies the VPN gateway to the client.
Mutual Authentication
Optional client certificate for mutual identity verification.
Encrypted Tunnel
TLS creates a secure tunnel for submitting authentication credentials.
Authentication Processing
Typically handled by a RADIUS server.
Communication Tunneling
VPN gateway tunnels all local network communications over the secure socket.
TCP or UDP
TLS VPN can use either protocol.
UDP (Datagram TLS - DTLS)
Chosen for better performance with latency-sensitive traffic (e.g., voice, video).
TCP
Easier to use with default firewall policies.
Secure Versions
TLS 1.3 and TLS 1.2.
Deprecated Versions
Versions earlier than TLS 1.2.
TLS Transport Layer Security

Examples & real-world scenarios

Supplementary — not from your PDF
  • A browser-launched SSL/TLS VPN client.
  • DTLS carrying a video call through the VPN.
  • Requiring client certificates for mutual authentication.

Scenario

Remote staff complain that video calls over the VPN are choppy. Switching the TLS VPN to UDP (DTLS) usually helps latency-sensitive traffic.

Common mistakes

Supplementary — not from your PDF
  • Allowing TLS 1.0 or 1.1. Only 1.2 and 1.3 are considered secure.
  • Thinking TLS VPNs only work over TCP.

Practical skills

Supplementary — not from your PDF
  • Configure the protocol choice and minimum TLS version for a TLS VPN.

What I should remember

Key Points PDF p.144
  • TLS VPN
    • Digital Certificates: Client-server connections.
    • Server Certificate: VPN gateway identification.
    • Mutual Authentication: Optional client certificate.
    • Encrypted Tunnel: Secure authentication and communication.
    • RADIUS Server: Authentication processing.
    • Communication Tunneling: Secure socket.
  • Protocol Options
    • TCP or UDP: Protocol choices.
    • UDP (DTLS): Performance for latency-sensitive traffic.
    • TCP: Firewall policy compatibility.
  • TLS Versions
    • Secure Versions: TLS 1.3, TLS 1.2.
    • Deprecated Versions: Earlier than TLS 1.2.